ninenines gun up to 2.3.x reference behavioral workflow

Summaryinfo

A vulnerability classified as problematic has been found in ninenines gun up to 2.3.x. Affected by this vulnerability is the function reference. This manipulation causes behavioral workflow. This vulnerability appears as CVE-2026-43974. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in ninenines gun up to 2.3.x and classified as problematic. Affected by this vulnerability is the function reference. The manipulation with an unknown input leads to a behavioral workflow vulnerability. The CWE definition for the vulnerability is CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. As an impact it is known to affect availability. The summary by CVE is:

Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switching Protocols response is received over HTTP/1.1, the function verifies only that the Upgrade header is syntactically valid and that the stream reference is a plain reference(). It does not check whether the client ever sent an Upgrade or Connection: upgrade header on the corresponding request. Because this check is absent, any 101 response (solicited or not) causes gun to dispatch a gun_upgrade message to the caller and transition the entire connection to raw protocol mode. A malicious or compromised HTTP server can send an unsolicited 101 response to any HTTP/1.1 request, causing the gun client to abandon HTTP framing for that connection. Once in raw mode, gun_raw applies no flow control (flow=infinity) and re-arms socket active mode after every received packet, so the server can flood the client with arbitrary bytes. These are forwarded as unbounded gun_data messages to the owner process, exhausting its mailbox and BEAM memory, ultimately crashing the VM. This issue affects gun: from 2.0.0 before 2.4.0.

The weakness was presented by Peter Ullrich. The advisory is shared at cna.erlef.org. This vulnerability is known as CVE-2026-43974 since 05/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 2.4.0 eliminates this vulnerability. Applying the patch 5b48068c29ce5e112cb149b5857c7d4dc319a81b is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-35072). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• ninenines

Name

• gun

Version

• 2.0
• 2.1
• 2.2
• 2.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion